Behavior of Gratuitous ARP in Windows NT 4.0

ID: Q199773

The information in this article applies to:

Microsoft Windows NT Server version 4.0
Microsoft Windows NT Workstation version 4.0
Microsoft Windows NT Server, Enterprise Edition version 4.0
Microsoft Windows NT Server version 4.0, Terminal Server Edition
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server

SUMMARY

This information applies to Windows NT 4.0 with Service Pack 3 or higher installed.

Statically Addressed Computers

When starting, a statically addressed Windows NT computer will perform a gratuitous ARP up to 3 times: 1 time when the TCP/IP stack initializes, and 2 more times after .5 and 1 second intervals, if no response is received.

Whenever a statically configured IP address is changed (for example, using the Network tool in Control Panel), Windows NT sends a single gratuitous ARP.

If Windows NT receives a response to a gratuitous ARP, it disables the interface that issued the gratuitous ARP, generates an event (event ID 26), and generates a pop-up dialog box on the console warning the user that a duplicate IP address has been detected resulting in the shutdown of the affected interface.

DHCP-Addressed Computers

Any time a DHCP lease is obtained, Windows NT sends a single gratuitous ARP.

If Windows NT receives a response to this gratuitous ARP, it sends a DHCP DECLINE message to the DHCP server, and then attempts to obtain another lease.

Windows NT Response to IP Address Conflict

If Windows NT receives a gratuitous ARP for its own IP address, it generates an event (event ID 26), generates a pop-up dialog box on the console warning the user that a duplicate IP address has been detected, but does not shut down the affected interface. It then sends a gratuitous ARP to make sure that the offending computer has shut down its interface.

MORE INFORMATION

Gratuitous ARP, also called a courtesy ARP, is a mechanism used by TCP/IP computers to "announce" their IP address to the local network and, therefore, avoid duplicate IP addresses on the network. Routers and other network hardware may use cache information gained from gratuitous ARPs.

It is possible, if a machine issues a gratuitous ARP but is not challenged, that two computers on the network might be simultaneously using the same IP address. In this case, packet routing (particularly on switches with VLANs) could be diverted from the original holder of the IP address to the new holder as ARP caches are updated on the router.

This is likely to be a problem only on networks where there are a high number of errors or lost packets, or where latency is high (above .5 second).

One other circumstance can cause this problem. Most switches use a spanning tree algorithm to build tables of media access control address <--> port number associations. While the spanning tree is reconfigured, there is typically a short delay, during which time the client might not have full connectivity. Unfortunately, this delay usually occurs about the time the switch becomes aware of the client, which is usually the time when the client's network stack is initializing (and gratuitous ARPs are being sent).

To overcome this problem, some switch manufacturers have implemented a software setting that causes the switch to treat new clients as broadcast clients (like a hub) until the spanning tree is fully reconfigured.

This aspect of switches can have other side effects. For additional information, please see the following article(s) in the Microsoft Knowledge Base:

Q168455 DHCP Renewal Failures on Switched Networks

Additional query words:

Keywords : kbnetwork
Version : WINDOWS:2000; winnt:4.0
Platform : WINDOWS winnt
Issue type : kbinfo